Resolve bundled baselines vs writable overrides (lifecycle 3/6)

[pullfrog]

Closes #22. Part of #6 (plugin lifecycle).

A plugin id can exist as both a packaged core copy and a writable user copy; the backend loads at most one. This resolves which copy that is, mirrors core's _is_bundled rule, and reports it per row.

Behavior

• Precedence (mirrors core's _is_bundled): a core copy that sits in a directory named after its id with "bundled": true is a bundled baseline and always wins; any other packaged copy yields to a writable user copy, because the backend scans the user plugins dir first.
• plugins:catalog rows gain activeSource: 'bundled' (packaged copy loads), 'writable-override' (user copy shadows a packaged non-baseline), 'installed' (user copy, no packaged one beneath), or 'none' (nothing on disk). Exactly one value per id, always.
• installedVersion keeps meaning "the user copy's version" and bundled keeps meaning "a qualifying baseline exists", so the existing renderer state logic (pmCatalogState) is unchanged. Making the UI display activeSource is issue Build a filterable plugin catalog and selection UI #4's screen work, out of scope here.
• Install refusal is behavior-identical: the installer still refuses to install over bundled-baseline ids in both the batch and single-install paths.

Verification

• npm run typecheck — clean.
• node --test tests/plugin-precedence.test.js — 15 pass (bundled only, override only, both present, override removed, plus scan determinism).
• node --test tests/plugin-catalog-view.test.js tests/plugin-installed-state.test.js tests/plugin-lifecycle.test.js tests/plugin-installer.test.js tests/plugin-catalog.test.js tests/plugin-selection.test.js tests/plugin-setup-state.test.js tests/config-paths.test.js — all pass.
• .github/workflows/ci.yml gained a Run plugin precedence tests step; the YAML was re-parsed.

Notes

• Divergence from core: the desktop resolves two directories in the same root claiming one id by sorted directory name; core's unsorted scan has no such guarantee. This only affects which copy's version installedVersion names — activeSource distinguishes only between the core and user roots and is unaffected. Documented in docs/PLUGIN_CATALOG.md.
• The scan and the rule live in a new electron-free module src/main/plugin-precedence.ts so the decision is unit-testable under node --test.

  ^{｜ View workflow run ｜ via Pullfrog ｜ Using big-pickle (free) ｜ 𝕏}

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 13 complexity · 0 duplication

Metric	Results
Complexity	13
Duplication	0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[pullfrog]

Addressed both threads on review 5437437767 of #32 — no code changes, both findings verified as false positives.

• src/main/plugin-precedence.ts:71 (path.join(dir, 'plugin.json')): dir only ever receives the two app-derived roots — app.getPath('userData')/plugins and findSlopsmithDir()/plugins (src/main/python.ts:423, 986). No IPC or renderer value reaches it, and the call is unchanged code moved out of plugin-manager.ts. Replied with that reasoning.
• src/main/plugin-precedence.ts:97 (path.join(dir, name)): name comes from fs.readdirSync(dir), and an entry name cannot contain a path separator or be ./.., so the join cannot escape dir. The scan only reads plugin.json; PluginCopy.dir is never used as a path downstream, and every write through the plugins root goes through resolveSafePluginDir. Replied likewise.

Working tree untouched and clean; both threads left open as disagreements rather than resolved.

Task list (1/5 completed)

• Checkout PR Resolve bundled baselines vs writable overrides (lifecycle 3/6) #32 branch
• Fetch and read review comments
• Verify findings against code and address each thread
• Quality check: fresh comments, test, commit, push
• Reply to threads and report progress

  ^{｜ View workflow run ｜ via Pullfrog ｜ Using big-pickle (free) ｜ 𝕏}

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (7 files)

• src/main/plugin-precedence.ts — new module; clean
• src/main/plugin-manager.ts — scan refactor; clean
• src/renderer/plugin-manager/screen.js — comment-only change; clean
• tests/plugin-precedence.test.js — new suite; clean
• tests/plugin-selection.test.js — activeSource field plumbing; clean
• tests/plugin-catalog-view.test.js — activeSource field plumbing; clean
• docs/PLUGIN_CATALOG.md — documentation; clean
• .github/workflows/ci.yml — new test step; clean

---

_{Reviewed by free · Input: 551.1K · Output: 42.8K · Cached: 541.7K}